AD-DC-07: DC operating system count should be retrievable
| ID | AD-DC-07 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Domain controllers |
| Security area | Infrastructure hardening |
| Resource type | DomainController |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Knowing the operating systems running on your domain controllers is important for:
- Lifecycle management: Identifying DCs running end-of-life operating systems
- Security patching: Ensuring all DCs receive security updates
- Feature availability: Determining which AD features are available
- Standardization: Reducing OS variety for easier management
- Upgrade planning: Identifying DCs that need to be upgraded
Running outdated operating systems on domain controllers poses security risks as they may not receive security patches.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Standardize on a supported Windows Server version for all DCs
- Plan to upgrade DCs running end-of-life operating systems
- Ensure all DCs are receiving security updates
- Consider running the latest Windows Server version for new DCs
Current Windows Server support status:
- Windows Server 2022: Supported
- Windows Server 2019: Supported
- Windows Server 2016: Supported
- Windows Server 2012 R2: Extended support ended October 2023
- Windows Server 2012: Extended support ended October 2023
- Earlier versions: Not supported
How the Test Works
Section titled “How the Test Works”This test retrieves the OperatingSystem attribute from all domain controllers and counts the unique OS versions in use.
Related Tests
Section titled “Related Tests”Test-MtAdDcOperatingSystemDetails- Detailed OS distribution breakdownTest-MtAdDomainControllerCount- Total DC count
Related links
Section titled “Related links”- Microsoft Learn: Windows Server release information
- ANSSI Active Directory checkpoints: DC/RODC with an obsolete operating system
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.